LSM: Tie enabling logic to presence in ordered list
Until now, any LSM without an enable storage variable was considered
enabled. This inverts the logic and sets defaults to true only if the
LSM gets added to the ordered initialization list. (And an exception
continues for the major LSMs until they are integrated into the ordered
initialization in a later patch.)
Signed-off-by: Kees Cook <keescook@chromium.org>
diff --git a/security/security.c b/security/security.c
index 2e1f48e..b6d3456 100644
--- a/security/security.c
+++ b/security/security.c
@@ -63,10 +63,10 @@
static bool __init is_enabled(struct lsm_info *lsm)
{
- if (!lsm->enabled || *lsm->enabled)
- return true;
+ if (!lsm->enabled)
+ return false;
- return false;
+ return *lsm->enabled;
}
/* Mark an LSM's enabled flag. */
@@ -117,7 +117,11 @@
if (WARN(last_lsm == LSM_COUNT, "%s: out of LSM slots!?\n", from))
return;
+ /* Enable this LSM, if it is not already set. */
+ if (!lsm->enabled)
+ lsm->enabled = &lsm_enabled_true;
ordered_lsms[last_lsm++] = lsm;
+
init_debug("%s ordering: %s (%sabled)\n", from, lsm->name,
is_enabled(lsm) ? "en" : "dis");
}
@@ -210,6 +214,10 @@
if ((lsm->flags & LSM_FLAG_LEGACY_MAJOR) == 0)
continue;
+ /* Enable this LSM, if it is not already set. */
+ if (!lsm->enabled)
+ lsm->enabled = &lsm_enabled_true;
+
maybe_initialize_lsm(lsm);
}
}